What AI-found security flaws mean for your business

AI tools are now being used to check software for security flaws, and they are finding problems that have gone unnoticed for years. Two examples in October involved software that many businesses rely on. One was Fortinet, which makes the FortiGate firewalls we manage for many of our clients. The other was PHP, the software behind most websites.

Attackers can use the same kind of AI tools, and they are moving faster as a result.

Fortinet asked customers to update straight away

On 21 October, Fortinet released urgent security updates for its FortiGate firewalls and several related products. Fortinet said the flaws were found through its AI-assisted security testing, and thanked AI companies including Anthropic, OpenAI and Google for their help.

Normally a vendor publishes the details of a flaw at the same time as the fix. This time Fortinet released the fixes first, with the details due on 10 November. It asked customers to install the updates as a priority and warned that attackers can now use AI to work out what an update fixes and build an attack in hours or days.

We manage FortiGate firewalls for many of our clients, so we acted on that advice. We made an unplanned change and upgraded the firewalls exposed to the internet before any attack had been seen.

A flaw in the software behind most websites

In the same week, the team that looks after PHP released urgent fixes for two serious flaws, now known as PHP2Shell. PHP runs most of the world’s websites, including every WordPress site. The flaws had been in the software for years and were found by researchers using AI tools.

Details of the flaws leaked before the fixes were released. Within hours, attackers were trying to use them against websites around the world, and the number of attempts soon reached the millions.

Why patching must be faster now

AI is now finding flaws that have been present in widely used software for years. It’s finding them faster than traditional patching cycles were designed for.

When a fix is released, attackers study it to work out what it fixes and how to use the flaw. This used to take attackers weeks, and it can now take a few hours.

Cyber security plans written for the old pace need updating. To keep up, defenders need AI-level capability too, so threats can be detected, assessed and acted on sooner.

What this means for your firewall

We normally install firewall updates on a planned schedule, so we can test them first and keep disruption to a minimum. That still works well for routine updates.

When a vendor warns that an update is urgent, as Fortinet did in October, waiting for the next scheduled window is now too risky. In those cases, we may need to update your firewall outside our usual schedule, sometimes at short notice. We’ll let you know when this happens and keep any interruption as short as we can.

What we’re doing about it

We’re also redeveloping our managed cyber security plans. The base plan will include more protection as standard, and a new higher-tier plan will be available for clients who need more. You’ll hear more about both very soon.

If you have a website

iTops doesn’t host or manage websites, but we know many business websites aren’t part of anyone’s regular update routine. They’re often built, launched and then left alone, with nobody clearly responsible for keeping the software underneath up to date. PHP2Shell showed why that matters, and we know some of our clients were affected.

Ask whoever looks after your website who is responsible for updates, whether the October PHP fixes were applied, and whether there’s a recent backup if the site is hacked or goes offline. If you’re not sure what to ask, we’re happy to help. If you’re looking for a web partner who includes hosting and security in what they offer, we recommend Christchurch company Meta Digital.

If you have questions about your firewall or your current level of protection, we’re happy to help.